BOSH CLI CVE-2026-47827

Exploitation requires the attacker to be on the same adjacent network segment as the Windows host running BOSH CLI - internet-based exploitation is ruled out by AV:A. The vulnerability is Windows-platform-specific; Linux deployments of BOSH CLI are not indicated as affected. High attack complexity (AC:H) implies additional specific conditions must be met, but the exact triggering configuration or CLI subcommand is not described in available data - this is a gap that defenders should resolve by reviewing the vendor advisory. The PR:N metric confirms no authentication is required once adjacency is established, removing credential-based barriers. Limiting factors include: adjacent network access only (significant geographic/topological constraint), Windows-only platform scope, and unspecified high-complexity preconditions that may further narrow exploitability. Defenders in environments that do not run BOSH CLI on Windows are not exposed to this specific attack path.

The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 7.5, reflecting full CIA impact but tempered by adjacent-only reach and high attack complexity. Adjacent network access (AV:A) limits the exploitable population to attackers already inside Cloud Foundry management network segments - this is a meaningful constraint that reduces internet-scale risk significantly. High attack complexity (AC:H) implies specific conditions must align, though these conditions are not detailed in available data; this creates uncertainty about how reproducibly the vulnerability can be triggered. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no public exploit code has been identified - exploitation status is 'no public exploit identified at time of analysis.' The combination of AV:A and AC:H substantially limits blast radius compared to a network-facing, low-complexity flaw of equal CVSS impact. However, for organizations running Cloud Foundry BOSH on Windows in shared or multi-tenant management planes, the PR:N requirement means no authentication barrier exists once adjacency is achieved. SSVC signals: exploitation status unproven, automatable classification unclear due to AC:H, technical impact total if reached.

An attacker with foothold on the Cloud Foundry management network - for example, a compromised internal jump host or a co-tenant in a shared PaaS management segment - sends a crafted input to the BOSH CLI process running on a Windows operator workstation. The CLI passes the input to a PowerShell execution context without sanitizing shell metacharacters, causing the injected command to execute with the privileges of the BOSH CLI process. No public exploit code has been identified at time of analysis, but PowerShell injection patterns are well-documented and could be adapted by an attacker familiar with the BOSH CLI's command processing logic.